Search This Blog

Email Injection

Not so long ago, I ran a wiki called SecurePHP. On that wiki, there was one particular article about email injection that received a lot of attention. Naturally, with all the attention came lots of spam. As a result, I disabled editing of the wiki and content stagnated. Still, the email injection article remained popular. About a year later, the server that hosted SecurePHP died and I never had a chance to hook it all back up. I saved the article though and I'm reposting it now. It may be a bit old (I've been away from PHP for a long time), and I didn't write all of it, so feel free to leave comments about needed updates and corrections. Though this article focuses on PHP, it provides a lot of general information regarding email injection attacks.

The PHP mail() Function

There are a lot of ways to send anonymous emails, some use it to mass mail, some use it to spoof identity, and some (a few) use it to send email anonymously. Usually a web mailform using the mail() function generates emails containing headers with the originating IP of the server it's running on. Therefore the mailform acts as a SMTP proxy. The input fields of the form may vary, but it is common to specify a mailform that gives you control over the subject, the message, and the sender's email address.

Extra params are not commonly fed from user input, so we'll skip this part. Most webmasters carefully hardcode the recipient's email address into the contact form of their web application. You might think this eliminates the way this kind of script could be exploited. But, you would be be wrong!

When looking at the HTML form or at the code, it seems obvious one cannot choose the recipient email address as it is hardcoded in the script. However, it is possible to choose the subject, the message, and the sender's email address (From: header). The PHP mail() function roughly works as follows:

The PHP code for the mailform provided earlier shows that the most interesting part the user can choose to feed in the form is the sender email address, because it is directly displayed inside the headers. In this example it is possible to modify or add other headers than the From: using this form. Of course the message, To and Subject fields could also be used to inject some data but the mail() function and the RFC specifications would filter any content given to those fields to prevent it from being abused.

What's the use of injecting email headers?

In this context, the target is to be able to send anonymous emails to other recipients. There are numerous additional fields that can be specified in the mail headers (see RFC 822). For example Cc (Carbon Copy), which sends a copy of the message to the email addresses given as arguments. A better choice is to use the Bcc (Blind Carbon Copy) which sends a carbon copy of the message just like with the Cc header, except that the recipiends email addresses given as arguments are not shown to the multiple recipients' headers. As specified in RFC 822, you must add a line feed for every header. The LF (line feed) char has a hexadecimal value of 0x0A.

By providing the following values to the example script of this article:

The mail headers were injected successfully! Despite the fact that the only header value take from the HTML form is From:, the resulting email has been sent to three people of our choice: recipient@someothersite.xxx, somebloke@grrrr.xxx and someotherbloke@oooops.xxx.

In the last example, both Cc and Bcc headers have been used to perform the injection. It would also have been possible to use the To header, the last value is added (just like in the Cc and Bcc fields) to the hardcoded email address of the webmaster.

Example 2

Let's keep the same value for subject and message, and give the following value to the sender email@anonymous.xxx%0ATo:email1@who.xxx. The mail output is:

Repeating the To header won't be a problem, the mail will be sent to recipient@victim.xxx AND email1@who.xxx.

Now for something completely evil...

Let's consider spam.

Many sites provide the possibility to "email this page to a friend" through a web form, the resulting email softly suggests to "visit our website" on behalf of the user that filled in the form with his personal email address, and the email address of the friend he wants the page to be emailed to.

Even though the subject and the message are hardcoded, there is still a way to inject headers (we already know how to add recipients). As covered earlier in this article, we saw that the To header can be sent twice, the Subject header is not an exception to this rule, and so it is for numerous other headers. By providing a recipient address of buddy@pal.xxx and a sender address of misterburns@springfield.xxx%0ASubject:My%20Anonymous%20Subject the email body will look like this:

The subject "My Anonymous Subject" will be added to "Visit our site www.website.xxx!", and in some cases will replace it (depending on the mail services, SMTP relays, mail client, etc). For example Hotmail displays the added subject inside the message.

Let's see now how to alter the message body. The difference between the body and the headers is that the body cannot be identified by its name (From, To, etc); there is no such Message header existing in the RFC 822. And that's exactly how we will alter this part of the mail, a LF; with no header name means that the message body started. So, instead of specifying a LF and a header name, we will just add a LF and give our message.

As both To and Subject headers are already defined, the resulting output will contain both the older message and the injected message, except that instead of being appended, it will be prepended. Say we provide the sender badguy@badboys.com%0A%0AMy%20New%20%0AAnonymous%20Message. Then the email will look like this:

Hello,
A friend thought you might want to see this page: www.website.xxx.
Bye Bye

to finally give this message:

My New
Anonymous Message
Hello,
A friend thought you might want to see this page: www.website.xxx.
Bye Bye

There are more headers than Cc, Bcc, To, Subject and From but this article will not cover all of them as they are not especially helpful for this article. However, the Content-Type header can be very useful. It has a default value set of plain/text.

It is possible to re-define this header as text/html, and then provide some HTML content to the message by giving this value to the sender's email address haxor@attack.com%0AContent-Type:text/html%0A%0AMy%20%New%0A<u>HTML%20Anonymous%20Message.</u>%0A.

When displayed, this email will have the text "HTML Anonymous Message" underlined.

MIME

The mail() function respects the MIME encoding. By knowing this, the header Content-Type can be used in different ways for injection purposes. The MIME encoding (Multipurpose Internet Mail Extensions) can be used, in addition to send HTML mails, to attach files (sound, image, txt, etc).

The fact is that the header Content-Type can be re-defined as multipart/mixed (or multipart/alternative or multipart/related), even though it was already defined previously.

The injection possibility for this header is that the "multipart/mixed" can help us to separate the mail in several parts.

First we see the header To, Subject and From then the Content-Type defined as multipart/mixed, then the "boundary" line which value is MyBoundary. This boundary stuff is used as a separator (see RFC 822 for detailed info) inside the message. It is also used to set the beginning/end of the first/last part (--[THE BOUNDARY]). Note: "[THE BOUNDARY] can be replaced by any (US/ASCII [:alnum:]) value. Then we see a line "Hidden Text1". This text will not be visible to the recipient, because it is located before the first boundary declaration. Then we see the --MyBoundary line, announcing the beginning of the first message, and then, just after the Content-Type header (which will define the content type of this specific message part), some simple text. Then we see the message, and the line --MyBoundary--, announcing the end of the email, and consequently having the last part "Hidden Text2" hidden to most web clients.

Now the originating message and subject, both hardcoded in php, are ignored. So by providing the sender value haxor@attack.com%0AContent-Type:multipart/mixed;%20boundary=frog;%0A--frog%0AContent-Type:text/html%0A%0AMy%20Message.%0A--frog--

And the message received by "recip@ient.xxx" is an HTML message containing "My Message." The hard coded advertisement message (below) is NOT displayed:

Hello,
A friend thought you might want to see this page : www.website.xxx.
Bye Bye

Note: boundary is sent with no quotes this time, just to show it applies even if magic_quotes_gpc=ON.

This method is applicable in different context. Imagine a script where sender can be specified and where some other field (like first name, last name, age, etc) is echoed in the message body once the form is submitted. In that case it is possible to get the same results (choose exactly what message the receipt will see) by providing haxor@attack.com%0AContent-Type:multipart/mixed;%20boundary=frog;%0A in the sender header and %0A--frog%0AContent-Type:text/html%0A%0AMy%20Message.%0A--frog-- to the optional field (e.g nickname). The resulting mail will look like:

As you can see, the hard coded message has been split in two. The value of the optional field (nickname) has been replaced by the injected message, and whatever is after the inserted text will NOT be shown in the mail client.

Example 3

Now a last example, compiling all possibilities seen in this article, and more. Provide this value as the sender:

So, the sender is "haxor@attack.xxx", the subject is "Visit www.website.xxx ! Oooops", the email will be received by "pal@friends.xxx", and a carbon copy will be sent to "target@nothappy.xxx". The email content will be HTML:

HTML Message.
a file named "Nastycode.html" with content type "text/html" will be attached to the email:
HTML File

<panic>

Now that the problem has been described, enjoy some scheduled panic time.

</panic> (Solutions)

And now that you've stopped panicking, here are several ways to combat email injection.

Regex

The first rule (the golden rule) is to always filter and validate user data. One possibility is to use regular expressions or string functions:

We can see in the above script that any occurrence of \r or \n will make it die(). \n is equal to LF (line feed or 0x0A/%0A in hexadecimal), and \r is equal to CR (carriage return or 0x0D/%0D in hexadecimal).

Zend_Mail

You can use the Zend_Mail component as your mail sender class. It provides protection to this problem by default, no action is required from the programmer.

PEAR Mail

The PEAR Mail class provides protection against this problem since version 1.1.13.

Swift Mailer

Swift Mailer class is not vulnerable to this attack.

Suhosin

The Suhosin PHP extension provides the suhosin.mail.protect ini directive, with 3 different levels of protection.

ModSecurity

ModSecurity can put a stop to email injection on the server level.

With ModSecurity it is possible to scan the POST or GET body for Bcc, Cc, or To and reject any request that contains those letters. To protect against main injection, add the below rule to your modsecurity setup:

However, there are plenty of legitmate reasons to use the word "to" in an email and blacklists are never complete. Whitelisting is always a better option. gotroot.com is a great source for ModSecurity rules. It is a good idea to use their rules and configuration to protect users against other PHP exploits. Any virtual host having issues with ModSecurity can have it disabled by adding the below setting to the VirtualHost container:

<IfModule mod_security.c>
SecFilterEngine Off
</IfModule>

In Conclusion...

Two points to remember when watching injections:

Any existing data located *after* the injection point can be replaced.

Any data to be added will always be located *after* the injection point (e.g. From).

There is another good point to this security measure despite the fact that subject and recipient values passed to the mail() function are cleaned, when using Emacs, the Fcc header is also protected from injections. This Fcc field contains the name of one file and directs Emacs to append a copy of the message to that file when you send the message. Although this works on Emacs, it is not possible with the PHP mail() function.

And remember, there are other related exploit possibilities that are not discussed in this article. Security requires research and vigilance.

Labels

Popular posts from this blog

I've put together a small collection of Android recipes. For each of these recipes, this is an instance of Context (more specifically, Activity or Service) unless otherwise noted. Enjoy :)

IntentsOne of the coolest things about Android is Intents. The two most common uses of Intents are starting an Activity (open an email, contact, etc.) and starting an Activity for a result (scan a barcode, take a picture to attach to an email, etc.). Intents are specified primarily using action strings and URIs. Here are some things you can do with the android.intent.action.VIEW action and startActivity().Intent intent = new Intent(Intent.ACTION_VIEW);// Choose a value for uri from the following.// Search Google Maps: geo:0,0?q=query// Show contacts: content://contacts/people// Show a URL: http://www.google.comintent.setData(Uri.parse(uri));intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);startActivity(intent);Other useful action/URI pairs include:Intent.ACTION_DIAL, tel://8675309Intent.ACTION_CALL…

I managed to put together a wireless accelerometer the other night using my two new XBees, an Arduino XBee shield, an XBee Explorer USB, an ADXL330, and some Python. I struggled a bit with some of it, so here's what I learned:

The first thing to do is to configure and upgrade the firmware on your XBees. To do that, you'll need X-CTU (for the firmware upgrade at least, but it's also nice for configuration) which, unfortunately, is only available for Windows. But, it works fine from VMware. First up, the XBee we'll hook up to the computer to read incoming data from the accelerometer:Plug one of the XBees into the Explorer (it's also possible to do this from the Arduino shield by shifting the two XBee/USB jumpers to USB and remo…